Documentation's navigation



On this page


FAQ about Space Privacy

An app's license can only be used in one Confluence instance. However, you can create as many extranet spaces as you want.

In order to use Space Privacy in other Confluence instances, you will need to obtain another license.

The required license tier is based on the number of users in the Confluence instance.

The most likely cause is a misconfiguration or a third party app which adds custom views to Confluence which are not supported by our app.


Please go through the following steps to figure out if your configuration has resulted in the unwanted user visibility.


  1. Are the affected users assigned to an extranet space? The global setting: Who can see and find users that are not assigned to an extranet space? has the option All users. Only extranet users are restricted to search and view other extranet users.
  2. Is it possible to see other users in the Confluence user directory (path: /browsepeople.action) and view their profiles? In this case, the user has permissions configured to the see the other user.
  3. Are the users assigned to the same extranet space? Users who share the same extranet spaces, can collaborate and are allowed to see each other. Please consider that users also can be assigned to extranet spaces via Confluence groups.
  4. Is the user, who can see "too many" users, a Confluence administrator or has the administrator role "Extranet Manager" or "Extranet User Manager" in one of your extranet spaces? In this case, the user must be allowed to see all other users to be able to manage the extranet space. Only assign administrator roles to users that should be allowed to see all other users.


If none of the steps above find the cause of your problem, it is either an unsupported feature from a third party app or a problem with your Space Privacy app. In both cases, please send a report to our app support team: https://seibert.biz/apphelp



This situation often occurs in pure extranet instances.


Only global administrators, space administrators and extranet user administrators have access to all users, so that assigning them to extranet spaces is possible. Until a user is assigned, they won’t be able to see any other users in the system.


This is especially useful, if adding external users is a process that’s independent from Confluence - in enterprises, employees often have to ask IT to add external users. Before one of those external users is added to an extranet space, they should not have access to other users and vice versa, which is why the previously mentioned option should be selected in the app configuration.


Solution:

  1. Create a dummy extranet space.

  2. Assign the groups that represent the internal users (employees) to this extranet space, e.g. “all-employees”, “internal-users” etc. Often, these users are from the connected LDAP (directory service), for example Active Directory (Microsoft). Space Privacy updates the group memberships, so that when users are removed from an assigned group, also lose the access to the corresponding extranet space.

    As a result, all internal users still see each other and can use Confluence as usual.

  3. If you also want your employees to work with external users, add the relevant users or groups to the respective extranet spaces.

    Only users that share one (or more) extranet spaces with external users, can be seen by them. This also applies to other external users (often locally managed) and internal employees of your company.


We already have a user story for a solution that does not require an extranet dummy in our backlog. However, we have not yet planned its implementation. Please contact us, if you are interested in sponsoring this development.




Check out visit the Visibility documentation page for more information.

Yes. You can assign users to an unlimited number of extranet spaces. This does not impact the security of any user data.

If user 1 was assigned to extranet spaces A and B, they can view all user data of the other users assigned to those spaces.


Check out visit the extranet users & groups documentation page for more information.

Yes. This is possible with Space Privacy, but not recommended.

If you wanted to work with external users from extranet spaces within your normal intranet instance, you might want to re-think your custom infrastructure. Internal users can work securely outside the company's premises within your normal Confluence instance if you use a company VPN.

Depending on your specific requirements, we would normally recommend that you set up a separate Confluence system for your extranet.

There are five different permission roles that you can assign to any group or single user. In our experience, these assignable roles cover most of the permission requirements for extranets.


If the default roles do not fit your needs, you can customize one in the global app administration under the tab User Roles.
Click on "Edit" to customize a role and set the permissions as you need.


(warning) Caution: Changes in permission apply to all available extranet spaces - including existing spaces.



Check out visit the user roles assignment documentation page for more information.

There are five different permission roles that you can assign to any group or single user. In our experience, these assignable roles cover most of the permission requirements for extranets.


If the default roles do not fit your needs, you can customize one in the global app administration under the tab User Roles.
Click on "Edit" to customize a role and set the permissions as you need.


(warning) Caution: Changes in permission apply to all available extranet spaces - including existing spaces.




Check out visit the user roles assignment documentation page for more information.

No.

There are three types of extranet administrator roles that Space Privacy uses:

  • The extranet administrator can manage both the users in the extranet spaces, as well as the extranet spaces themselves.
  • The administrator can manage the extranet space, but cannot add or remove users.
  • The extranet user administrator can manage users in the extranet space, but not the extranet space itself.



Check out visit the administration roles assignment documentation page for more information.

Yes, the app includes LDAP users as long as this was configured in the Confluence administration. This also applies to Atlassian Crowd or Jira Servers as a user directory.


However, it is absolutely necessary for local groups to be allowed, as Space Privacy creates groups for every extranet space. Users that are assigned to extranet spaces, are added to their corresponding groups.


Check out visit the administration roles assignment documentation page for more information.

 See how to set up user directories so they grant the required permissions for Space Privacy: User Directory Configuration


If you have any questions about this, please don’t hesitate to ask us. We would love to help you!

Our app aims to secure every standard Confluence UI component that is not added by third-party apps.

Some third-party apps are supported, if they use standard interfaces (e.g. for user search). Please let us know about problems you find with third-party apps, so that we can evaluate possible solutions. (https://seibert.biz/apphelp)

Space Privacy not only secures content via Confluence permissions. It also makes sure that only users who have at least one extranet space in common, can see each other in the system. For content permissions, the app uses Confluence space permissions. You don’t have to assign your custom permissions in extranet spaces: this would be counterproductive because it avoid the extranet user administration entirely.

The restricted visibility of users between extranet spaces is only possible through our app. Thus, when you deactivate the app all users will be visible to each other. Assigned content permissions remain as they were set.


Our security concept:

  • Visibility of extranet users is bidirectional except for administrative roles (confluence administrator, extranet administrator, extranet user administrator). If user Alice can see user Bob, user Bob can see user Alice. The administrator Charlie can see Alice and Bob, even though they might not share an extranet space.
  • Visibilities are different for global features (user profile, search, people directory) and space features (@-mentions, share page).
  • In global features (user profile, search, people directory) a extranet user can see every user, with whom he shares an extranet space. Alice is assigned to the extranet spaces A and C, Bob to B and C. That’s why they can find each other using search, or view each other's profiles.
  • For space features (@-mentions, share page) a user can only interact with extranet users that are also assigned to the current extranet space. Alice is assigned to extranet spaces A and C, Bob to B and C. They can both mention and notify each other in the extranet space C via @-mentions and share pages, but not in the extranet spaces A and B.


You can find more information regarding global and space features in FAQ answers: "What are global features and which of them are secured?" and "What are space features and which of them are secured?".

Global features are UI components or technical interfaces, that are not restricted to a single space.

The Space Privacy app ensures that users can see only those users who have at least one extranet space in common. Users in an administrative role (Confluence administrator, extranet administrator or extranet user administrators) always see every user in the system, as this is necessary to perform their roles.


At the moment, the following features and interfaces are secured:

  • User profiles
  • Global search
  • Search bar (quick search)
  • People directory -/browsepeople.action
  • User search in search filters (contributor, creator, network/contacts)
  • Macros: Livesearch, User List, User Profile, Content by User
  • Personal spaces (this should be covered by content permissions, but in case of a faulty configuration, we intervene)


The following features in combination with the Linchpin Intranet Suite are only recommended with restrictions or not at all:

  • Activity Stream/Recently Updated/All Updates

Space features are Confluence features that can only be used in spaces.

The Space Privacy app ensures that users can see only those users who have at least one extranet space in common. This prevents accidental interaction with users that don’t have access to the current extranet space. Regarding space features, even users in administrative roles (Confluence administration, extranet administrators or extranet user administrators) can not interact with users that are not assigned to the current extranet space.

The following space features are secured:

  • Mentioning users (@-mention)
  • Sharing pages


This means that users won't be able to mention or share pages with users they can't see!


Take a look at our list of compatible apps. There you can find a full overview.


Currently, Space Privacy supports these apps:

Yes and no. It depends on what you are using both apps for.


Please head over to our documentation regarding this very question.

You can export and import systems that use Space Privacy. Nevertheless you should keep the following in mind:

  • When you export and import, the same version of the app should always be used, otherwise updated features might cause problems.
  • Use the global export feature.
  • Do not export extranet data.

Confluence Server 6.6.0 and upwards.

Before you submit an issue with the Space Privacy app, please try to solve your issue with the following steps:

  1. Reload the page.
  2. Deactivate and activate the app (this is not 'magic' - heath checks are run when the app is activated).
  3. Only if you see the message: "Indexing User...": Rebuild the Confluence search index (Confluence Administration > Content Indexing).

If none of the steps above fixes your problem, please submit an issue (https://seibert.biz/help) with your application logs to help our analysis and find the cause of the problem:

  1. Set the log level for the key net.seibertmedia.extranet to DEBUG. Use the logging administration (Confluence Administration > Logging and Profiling) to add net.seibertmedia.extranet as the new logging key.
  2. Repeat the steps that caused the error - this will generate useful logs.
  3. Generate a Support ZIP (Confluence Administration > Support Tools - Atlassian Documentation)
  4. Export the Space privacy configuration from Confluence Administration > SPACE PRIVACY: Maintenance & Support
  5. Submit an issue and attach your support zip + Space privacy config: https://seibert.biz/help 

Deleting an extranet space will trigger the app to remove all related Space Privacy data for this space.


(warning) This means that extranet users who are only assigned to this space, might lose their "use Confluence" permission.

Explanation of the behavior

This is not a bug. It's intended behavior. Space Privacy aims to prevent any user data leaks when an extranet is used.

With Space Privacy 3.1, we introduced changes to the app which also affected Confluence's "Who can view this" function. We deliberately included new modules that block the "Who can view this" functionality to prevent a case in which users can see each other, even though they shouldn't.


Workaround

If you wish to restore the "Who can view this" functionality, you can manually disable the modules responsible for hiding it.

Be warned though that we strictly point out that disabling these modules can lead to unwanted user data leaks. When in doubt, please get in touch with your consultant to discuss the pros and cons of this workaround.


To restore the "Who can view this" function, please disable the following Space Privacy modules:

  • Remove Who can see this item Web Resource (remove-who-can-see-this-item-resource)
  • Gatekeeper People who can view Filter (gatekeeper-people-who-can-view-filter)


To disable a module, navigate to Confluence administration → Manage apps. Alternatively, insert /plugins/servlet/upm after your intranet URL.

Now, find Space Privacy and click on the x of x modules enabled button to the right. Find the correct modules and hover the mouse over them. Click on the now revealed Disable button.

Tip

Manually disabled modules remain disabled after app updates. If you ever wish to activate these modules again, you will have to repeat these steps and do it manually.

Link to this page: https://seibert.biz/spfaq


This page was last edited on 01/26/2024.